Every operator in the 2 to 30 million range gets asked for an AI strategy eventually. Usually by a board, sometimes by a bank, occasionally by a customer working through a vendor questionnaire. The request is fair. The answer is usually a 40-slide deck that nobody opens twice.
An AI strategy is not a deck. It is a short document that says which parts of your business you will change with software this year, in what order, and how you will know it worked. It fits on one page. Below is what belongs on that page, what to leave off, the European rules that shape it whether you read them or not, and the start plan that turns the page into something running in production.
What an AI strategy actually is
Strip the vocabulary away and a strategy is a set of decisions made in advance, so you do not have to make them under pressure. For AI there are four.
- Where you lose money today. Not where AI is interesting. Where the leak is, in euros per month.
- Which leak you fix first. One, ranked by cost, not by how good the demo looked.
- Who owns the result. A named person, internal or external, accountable when the number does not move.
- What you will not do. The tempting projects you are deliberately skipping this year.
A document that answers those four is a strategy. A document that surveys the technology landscape and ends with three horizons is a literature review with an invoice attached. We took that apart in most AI implementation is theater.
Why most AI strategy documents never ship anything
The failure is structural, not intellectual. Four separate jobs sit inside any AI programme: finding the leak, deciding what to fix, building the fix, and running it afterwards. A strategy document covers the second job and quietly assumes the other three.
So the deck lands, everyone agrees it is sensible, and nothing happens. Nobody measured the leak, so nobody can size the prize. Nobody is on the hook for the build. Nobody has been told who keeps the thing alive at 2am in December when it breaks. The strategy was not wrong. It was incomplete in exactly the places that require a person to do work.
The cheapest fix is to write the strategy after a measurement instead of before one. That inverts the usual order, and it is the whole reason our engagements open with an audit rather than a workshop.
What Europe means by an AI strategy, and why it is not yours
Search the phrase and the first results are government documents. They are worth reading once, and worth not confusing with your own plan.
The Apply AI Strategy and the AI Continent Action Plan
The European Commission publishes an Apply AI Strategy, which sits under the broader AI Continent Action Plan. Both are about adoption across sectors: getting European industry, healthcare and public services to use the technology rather than only to regulate it. Estonia runs its own national track under the kratt programme, published at kratid.ee and coordinated through the Ministry of Economic Affairs and Communications.
Those documents tell you where public money and public attention will point over the next few years. They tell you nothing about which of your invoices is late. Read them for context, close the tab, go back to your own numbers.
The rules you inherit either way
Two frameworks shape any private AI strategy in Europe, and neither is optional reading.
The EU AI Act sorts systems into 4 risk tiers: unacceptable, high, limited or transparency risk, and minimal. Most mid-market work sits in the bottom two. The obligation that bites day to day is the transparency duty: when a system talks to a person, that person has to know they are not talking to a human. Back-office document handling is quieter, right up until it touches hiring, credit, or anything else that decides something about a person.
The NIST AI Risk Management Framework is voluntary and American, and it remains the cleanest checklist anyone has published. Its four functions, govern, map, measure and manage, double as an honesty test for your page. If you cannot say who governs a system and how you measure it, you have a wish rather than a strategy.
The one-page AI strategy: what goes on it
Seven lines. If a line will not fit in three sentences, it is not decided yet.
- The leak. One sentence naming where money or time goes missing, with a monthly cost attached. We miss a third of inbound calls after 4pm beats we want to improve customer experience.
- The number that must move. One metric with a baseline you already counted. Missed calls, days to invoice, hours per month close, cost per handled ticket.
- The first system. What gets built, named concretely. A voice agent on the main line. Document intake into the ledger. Not an AI layer.
- The stack. The actual tools. Make.com or n8n for workflow, Vapi with ElevenLabs and Twilio for voice, whichever CRM you already run. Naming the stack forces the conversation about who hosts it.
- The owner. One name. If the honest answer is nobody, that is your finding for the quarter.
- The guardrails. Where a human stays in the loop, what data leaves the building, which processor agreement covers it, and which risk tier the system sits in.
- The not-doing list. Three things you are skipping and why. This is the line that keeps the page a strategy instead of a wish list.
That is the document. Anything longer is a proposal or a stalling tactic.
A practical start plan
Measure before you buy
Count the thing you want to fix for one normal month first. How many calls arrived after hours, how many went unanswered, what a booked job is worth. Without a baseline you can only argue about the result later. Our operator scorecard and the AI audit for business walkthrough both start here.
Pick one job, not a portfolio
Choose the single job with the highest monthly cost and ignore the rest for now. Five half-configured systems produce less than one that runs. We set out the sequencing logic in where to start automating operations.
Ship it beside the old process
Run the new system alongside the manual one for a month. Nobody gets fired, nothing gets deleted, and you get a fair comparison instead of a vendor chart.
Decide from the month, not the demo
At the end of the month, compare against the baseline you wrote on line two. If the number moved, write the next line of the page. If it did not, you learned something for the price of one month rather than one annual contract.
What to leave off the page
Three things belong in the bin.
Technology surveys. A list of models with release dates ages in six weeks, and it never told you what to build anyway.
Headcount fantasies. The claim that AI will let us avoid three hires cannot be tested this quarter, and it poisons the room the moment your team reads it. Talk about hours and euros instead.
Percentages you did not measure. A figure lifted from a vendor slide does not belong on a page you will be held to. The point of the exercise is that every number on it traces back to something you counted yourself.
What changed going into 2026
Two shifts, and both change the page.
The first is that buying beat building for most mid-market jobs. Published consultant rates still run roughly 150 to 350 US dollars an hour, with full builds between 20,000 and 150,000 US dollars, which we broke down in how much an AI consultant costs. Meanwhile a workflow on Make.com or n8n that would have been a quarter-long project two years ago is now a week of work. The strategic question moved from whether you can to who runs it afterwards.
The second is that the search surface moved. Customers now ask an assistant instead of typing a query, which turns your own content into a distribution channel rather than a marketing expense. On a transport client in Tartu the work was concrete: structured data coverage went from 4 schema types to 75, the hero image dropped from 60KB to 14KB, and an llms.txt file plus an explicit AI crawler allowlist told the assistants what to read. We wrote that up in how to get your business cited by AI. If your buyers ask machines about you, a line about being readable belongs on the page.
How to tell the strategy is working
One test, monthly. Take the metric on line two and ask whether it moved. Not whether people are excited, not whether adoption is up, not whether the pilot went well. Whether the number moved.
A second test, quarterly. Can somebody other than the person who built the system explain how it works and switch it off? If not, you do not have a system, you have a dependency. That is the same failure as the consultant who walks out with the knowledge, wearing a different costume.
Where to start
Write the leak line first, in euros, before anything else on the page. If you cannot fill it in, that is the finding, and the other six lines can wait a week.
That is what our free audit produces. About 30 minutes, no deck, and you leave with your leaks ranked by monthly cost whether or not you work with us. If you want us to build and run the first fix, that starts from 600 EUR per month plus VAT, quoted only after the audit, because a price quoted before anyone has seen your volume is a guess wearing a suit. The build side sits under automation, and the shape of the engagement is on the consultancy page. Once the page is written, the delivery detail is in how to implement AI in your business.
Questions operators ask about AI strategy
What is an AI strategy?
It is a short document that records four decisions: where your business loses money today, which of those leaks you fix first, who is accountable for the result, and which tempting projects you are skipping this year. Everything else is context. A document that surveys models and ends with three horizons is a literature review, not a strategy, because nobody can be held to it next quarter.
How long should an AI strategy be?
One page. The constraint is the point: a section that cannot be written in three sentences is a decision nobody has made yet, and a long document hides that. Keep the supporting measurement in an appendix if the board wants it, but the page itself stays short enough that the owner of each line can be named out loud in a meeting.
Do we need an AI strategy before we build anything?
You need a measurement before you build, and the strategy is what you write once you have it. The usual order is reversed and that is why so many programmes stall: the deck is approved, then nobody can size the prize because the baseline was never counted. Measure one normal month first, then write the page, then build one system.
What does the EU AI Act require from our AI strategy?
The Act sorts systems into 4 risk tiers and most mid-market work sits in the lower two. The duty that bites in practice is transparency: when a system talks to a person, that person has to know it is not a human. Anything touching hiring, credit or another decision about a person climbs the ladder fast, so name the tier on the page rather than assuming it.
Who should write the AI strategy?
Whoever will be accountable for the number moving, with help from whoever will build the system. A strategy written by people who never touch delivery reliably describes work that nobody has agreed to do. If an outside party writes it, ask a blunt question first: are they also building and running the fix, or handing you a document and an invoice.
A one-page AI strategy is harder to write than a 40-slide deck, because every line commits somebody to something. That is the feature. Start with the leak line, put a monthly number beside it, and if you cannot, book the audit that puts one there.